I have created a custom B2C_1A_SIGNUP_SIGNIN Policy.
Used Google Authentication.
When I hit the create button mypersonaltenantid gets validated through a Azure Function.
I am presented the error message You already registered, please press back button and sign in instead.
Before executing this policy i made sure this user does not exist-
After the error message is displayed i look inside B2C: The user was created incl. my custom claim with value mypersonaltenantid.
I was assuming that i am transferred to a different page after signup. Is this assumption wrong?
Created a Issue and got the final hint.
Looks like a action was performed twice. In my case I had a Base policy and a extension policy which had a ValidationTechnicalProfiles section.
Base.xml
<ValidationTechnicalProfiles>
<ValidationTechnicalProfile ReferenceId="AAD-UserWriteUsingAlternativeSecurityId" />
</ValidationTechnicalProfiles>
Extension.xml
<ValidationTechnicalProfiles>
<ValidationTechnicalProfile ReferenceId="REST-ValidateTenantId" />
<ValidationTechnicalProfile ReferenceId="AAD-UserWriteUsingAlternativeSecurityId" />
</ValidationTechnicalProfiles>
My assumption after both files get merged:
<ValidationTechnicalProfiles>
<ValidationTechnicalProfile ReferenceId="REST-ValidateTenantId" />
<ValidationTechnicalProfile ReferenceId="AAD-UserWriteUsingAlternativeSecurityId" />
</ValidationTechnicalProfiles>
But it looks like the merge is performed like this:
<ValidationTechnicalProfiles>
<ValidationTechnicalProfile ReferenceId="REST-ValidateTenantId" />
<ValidationTechnicalProfile ReferenceId="AAD-UserWriteUsingAlternativeSecurityId" />
<ValidationTechnicalProfile ReferenceId="AAD-UserWriteUsingAlternativeSecurityId" />
</ValidationTechnicalProfiles>
Of course that explains why AAD write is performed twice.
From my point of view the error message is quite misleading.
Related
I am working with the SocialAndLocalAccountsWithMFA starter pack and have discovered an issue. When I register a user I am prompted to setup MFA which works as intended. However, when I try to login with SSO I am being prompted for MFA again.
I have verified that I am not sending prompt=login.
I have attempted to search for an answer with no results or dead ends.
here is code snippets from my trustframeworkbase.xml
<OrchestrationStep Order="7" Type="ClaimsExchange">
<Preconditions>
<Precondition Type="ClaimsExist" ExecuteActionsIf="true">
<Value>isActiveMFASession</Value>
<Action>SkipThisOrchestrationStep</Action>
</Precondition>
</Preconditions>
<ClaimsExchanges>
<ClaimsExchange Id="PhoneFactor-Verify" TechnicalProfileReferenceId="PhoneFactor-InputOrVerify" />
</ClaimsExchanges>
</OrchestrationStep>
Here is my SM-MFA
<TechnicalProfile Id="SM-MFA">
<DisplayName>Session Mananagement Provider</DisplayName>
<Protocol Name="Proprietary" Handler="Web.TPEngine.SSO.DefaultSSOSessionProvider, Web.TPEngine, Version=1.0.0.0, Culture=neutral, PublicKeyToken=null" />
<PersistedClaims>
<PersistedClaim ClaimTypeReferenceId="Verified.strongAuthenticationPhoneNumber" />
</PersistedClaims>
<OutputClaims>
<OutputClaim ClaimTypeReferenceId="isActiveMFASession" DefaultValue="true" />
</OutputClaims>
</TechnicalProfile>
I think you have used "SM-MFA" technical profile inside "PhoneFactor-InputOrVerify" technical profile. So till this "PhoneFactor-InputOrVerify" technical profile is called, the claim "isActiveMFASession" will not exist and it will trigger MFA every time. Hence, this OrchestrationStep isn't being skipped, because the "isActiveMFASession" claim doesn't exist.
I use "DB navigator" plugin(https://plugins.jetbrains.com/plugin/1800-database-navigator/) for my Intellij IDEA Community version quite some time and am very satisfied.
I want to know the password of my DB connection saved in the plugin. They are saved, they are there, but I cannot share it with my teammates.
Even all the IDEA passwords are set to be stored in the system keyring, I don't find them in seahorse, i.e., "Passwords and Keyrings" application in my Ubuntu.
Where are they?
At last, I found it in
<project_root>/.idea/dbnavigator.xml
search your connection name, and you will see sth like this:
<connection id="e208f307-8c08-45d5-93fd-958c1d68d049" active="true">
<database>
<name value="UAT" />
<description value="" />
<database-type value="ORACLE" />
<config-type value="BASIC" />
<database-version value="11.2" />
<driver-source value="BUILTIN" />
<driver-library value="" />
<driver value="" />
<url-type value="SERVICE" />
<host value="some-host" />
<port value="1523" />
<database value="APP_DB" />
<type value="USER_PASSWORD" />
<user value="admin" />
<deprecated-pwd value="<base64-encoded-password>" />
</database>
...
</connection>
So, I tried to base64 decoded them... and it works...
Please, if the author sees this, please don't encrypt it in the future versions; I need them to be in my local so that I don't have to ask my teammates again; too shy am I. Please take into consideration that I created the tag db-navigator for the first time while asking this question, so that ppl around the world could gather together with love of this plugin.
And, any coder reading this: please ignore this file in Git, as it contains sensitive data.
Based on this question... the REST API endpoint is validating the external IDP email and is correclty returning an error back in the case the email is not valid.
return Content(HttpStatusCode.Conflict, new CustomResponseContent
{
Version = "1.0.0",
Status = (int)HttpStatusCode.Conflict,
UserMessage = message
});
Now I'd like to detect this error and use it in a subsequent OrchestrationStep like this:
<OrchestrationStep Order="3"
Type="ClaimsExchange">
<ClaimsExchanges>
<ClaimsExchange Id="REST-ValidateSignInEmail"
TechnicalProfileReferenceId="REST-ValidateSignInEmail" />
</ClaimsExchanges>
</OrchestrationStep>
<!-- Taken from here: https://medium.com/the-new-control-plane/creating-an-error-page-for-an-azure-ad-b2c-custom-policy-flow-fb2692a3b50f -->
<OrchestrationStep Order="4"
Type="ClaimsExchange">
<Preconditions>
<Precondition Type="ClaimEquals"
ExecuteActionsIf="true">
<Value>extension_Flag</Value>
<Value>False</Value>
<Action>SkipThisOrchestrationStep</Action>
</Precondition>
</Preconditions>
<ClaimsExchanges>
<ClaimsExchange Id="SelfAssertedRegError"
TechnicalProfileReferenceId="SelfAsserted-RegError" />
</ClaimsExchanges>
</OrchestrationStep>
If step 3 returns a conflict, I'd like to show the error message in step 4 using the custom error page implemented as described here.
I see that step 4 executes based on extension_Flag.
Is there any way I could retrieve and store the result from REST-ValidateSignInEmail and use it in the flag for step 4?
Note: when the user journey finishes executing I see the following AADB2C error in the URL. It comes from the REST API endpoint error (409 - Conflict)...
https://mywebsite.azurewebsites.net/#error=server_error&error_description=AADB2C%3a+user%40gmail.com+is+not+valid.%0d%0aCorrelation+ID%7a+7777f77-7afd-7777-a777-7c77b7e77b7b%0d%0aTimestamp%7a+2019-11-09+14%3a40%3a57Z%0d%0a&state=7777c77a-77ad-414a-84df-3c131ed81ba7
The error_description message is what I'd like to pass to step 4.
I did this in a different way... instead of returning a Conflict [409] status, I changed the REST endpoint to return an OutputClaim like this:
<OutputClaims>
<OutputClaim ClaimTypeReferenceId="extension_isEnabled"
PartnerClaimType="IsEnabled" DefaultValue="false"/>
<OutputClaim ClaimTypeReferenceId="errorMessage"
PartnerClaimType="ErrorMessage"/>
</OutputClaims>
This way I have a claim to check on step 4. Note that I also return an errorMessage from the endpoint. This error message will be later passed to SelfAsserted-RegError Technical Profile.
Depending on the validation done in the back-end, extension_isEnabled will get True or False.
On step 4 we check extension_isEnabled:
<OrchestrationStep Order="4"
Type="ClaimsExchange">
<Preconditions>
<Precondition Type="ClaimEquals"
ExecuteActionsIf="true">
<Value>extension_isEnabled</Value>
<Value>True</Value>
<Action>SkipThisOrchestrationStep</Action>
</Precondition>
</Preconditions>
<ClaimsExchanges>
<ClaimsExchange Id="SelfAssertedRegError"
TechnicalProfileReferenceId="SelfAsserted-RegError" />
</ClaimsExchanges>
</OrchestrationStep>
Step 4 will only be executed when extension_isEnabled is false. If it is true we SkipThisOrchestrationStep and the SelfAsserted-RegError Technical Profile won't be called at all. The UserJourney flow continues as expected.
I want to set a property in a custom action and use it in the standard custom action "util:User" afterwards. But no matter where I put the property in my wxs-file, I always get "error LGHT0094 : Unresolved reference to symbol"
Details:
In my setup I want to add a new user by using util:User. The user should be added to the group "Power Users" by using util:GroupRef. No Problem so far. Unfortunately the group names are language dependent. In german "Power Users" is "Hauptbenutzer". So I want to look up the well known SID S-1-5-32-547 in a custom action, set a property in this custom action by calling MsiSetProperty and then use the property for util:GroupRef.
As far as I understand, the property must be declared somewhere in the wxs-file.
In the examples I found, the property was never declared as follows (but I also tried that):
<Property Id="TextSID" Value="Power Users" />
In the examples there always was a custom action to set the property, like:
<CustomAction Id="SetTextSID"
Property="TextSID"
Value="Power Users"
Return="check" />
My problem is, that the creation of the user fails to "compile" because the property "TextSID" is not known:
<Component Id="CreateUser" Guid="Some GUID here in my original wxs file">
<util:User Id="UserUser"
Name="User" Password="Password"
CanNotChangePassword="yes" PasswordNeverExpires="yes">
<util:GroupRef Id="TextSID" />
</util:User>
</Component>
I have never done a custom action before and I'm a new to WiX and MSI, so any idea would be very welcome.
Regards
Ralf
Sorry for wasting your time.
I stared at my XML for hours before I posted this question, just to find the answer immediately after my post :-(
My only problem was, that it is not possible to reference to something that isn't there. In this case the "util:Group" was missing.
The below piece of code was written in struts-config file.but i am not able to understand it.
<action path="/showWelcome"
type="com.code.base.presentation.struts.actions.StrutsIoCAction"
name="LoanDetailPageLoadForm"
parameter="GET_WELCOME_PAGE"
input="welcomePage"
validate="false"
scope="request">
<set-property property="requestDTOKeyName" value="ItemDataRequest" />
<set-property property="responseDTOKeyName" value="ItemDataResponse" />
<set-property property="exceptionDTOKeyName" value="ProfileSekerException" />
<set-property property="businessServiceId" value="ItemsDataMgmtService" />
<forward name="success" path="welcomePage" />
<forward name="failure" path="sysError" />
</action>
My question is
what is the usage of path attribute?
what is the usage of parameter attribute?
what is the usage of input attribute?
what is the usage of <set-Property>?
Help me guys on this.
Note:
as per my understanding there should be "showWelcome.jsp" page in the application but it is not there.(then what is use of that?)
It specifies where the action is mounted. For example, this action would respond on http://yourservice.dom/showWelcome.
Parameter is the string you get by calling ActionMapping.getParameter(). Any string you want to pass to your action.
Input is a path where the user would be redirected if he fills the form incorrectly. As there's validate=false, I'd say that would never happen.
Obviously, it sets a property on com.code.base.presentation.struts.actions.StrutsIoCAction. I think it calls setter, i.e. it would call setRequestDTOKeyName(), setResponseDTOKeyName() etc.
But if you're going to use struts for a considerable time, QA won't get you far, read some docs on struts' config file.
Following on from #Alamar's response...
There is no showWelcome.jsp. "/showWelcome" is the URL, but that does not correspond to the name of any actual filename on the server. If this action's configuration contained a line like this:
<forward name="success" path="showWelcome.jsp" />
Then it would mean that if the action class (StrutsIoCAction) returns success, a file called showWelcome.jsp would be executed. However, as you can see, the actual configuration is a forward to "welcomePage", which is probably not a file but instead the name of another action (also defined in struts-config).
Note: "forward" just means that execution is passed to this other action, it does not mean that the user is redirected to another URL.